feat(sandbox): implement Linux sandbox helper binary#68

Merged

fohte merged 10 commits intomainfrom

fohte/impl-runok-init-linux-sandbox

Feb 22, 2026

Commits on Feb 22, 2026

sandbox: implement Linux sandbox helper binary with bubblewrap, landlock, and seccomp

fohte
and
claude
committed
sandbox: fix landlock additive rule semantics and accept &Path in rule helpers

fohte
and
claude
committed
sandbox: add test for helper binary discovery in exe directory

fohte
and
claude
committed
sandbox: add tests for create_executor and exec dry-run path

fohte
and
claude
committed
sandbox: align bwrap /tmp check with landlock to cover parent paths

fohte
and
claude
committed
ci: run tests with coverage for all workspace crates

fohte
and
claude
committed
sandbox: add missing `Compatible` trait import for landlock
fohte
committed
sandbox: add missing import and tests for uncovered code paths
fohte
committed
sandbox: fix exit_code_from_status test for dash shell
fohte
committed
sandbox: fix --tmpfs /tmp hiding writable roots under /tmp
fohte
committed